PT-2023-1338 · Argo Cd · Argo Cd

Changzhuo Chen

+1

·

Published

2023-01-25

·

Updated

2025-09-30

·

CVE-2023-22736

CVSS v3.1

8.5

High

VectorAV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Argo CD versions 2.5.0-rc1 through 2.5.7 Argo CD version 2.6.0-rc4
Description The issue is related to an authorization bypass bug in Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes. This bug allows a malicious Argo CD user to deploy Applications outside the configured allowed namespaces. The bug is triggered when the Application is updated, and the attacker must be able to cause an update operation on the Application resource. The sourceNamespaces field of AppProjects acts as a secondary check against this exploit. The bug only applies to users who have explicitly enabled the "apps-in-any-namespace" feature and have sharding enabled on the Application controller.
Recommendations For Argo CD versions 2.5.0-rc1 through 2.5.7, update to version 2.5.8 to resolve the issue. For Argo CD version 2.6.0-rc4, update to version 2.6.0-rc5 to resolve the issue. As a temporary workaround, consider running only one replica of the Application controller to prevent exploitation of this bug. Restrict all AppProjects' sourceNamespaces within the confines of the configured Application namespaces to minimize the risk of exploitation.

Exploit

Fix

DoS

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2023-00641
CVE-2023-22736
GHSA-6P4M-HW2H-6GMW
GO-2023-1512

Affected Products

Argo Cd